What Are the Top 10 Passwords?

[Man]

Based on an analysis by CyberNews, which reviewed over fifteen billion passwords found in data breaches, the following are the top ten most used passwords. These passwords are notably weak and insecure:

123456
123456789
qwerty
password
12345
qwerty123
1q2w3e
12345678
111111
1234567890

Here are other notable statistics on passwords from the Keeper Security Workplace Password Malpractice Report.

- Over one-third (37%) of respondents have used their employer’s name in a work-related password.
- Over one-third (34%) have used their significant other’s name or birthday.
- Nearly one-third (31%) have used their child’s name or birthday.

Wordlists are already created for you with these common and weak passwords; Kali, for instance, has a directory with many different wordlists. The most notable being rockyou.txt, nmap.lst, and john.lst. These lists can be found at /usr/share/wordlists.

Another great location for password lists is SecLIsts on GitHub. This resource contains many different password lists, such as “2020-200_most_used_passwords.txt” and “500-worst-passwords.txt”.

The Passwords directory will hold a number of password lists that can be used by multiple tools when attempting to guess credentials for a given targeted service. This will include a number of very popular lists in cooperation with their maintainers, including the RockYou lists maintained by Rob Bowes.

So why do people still use some of these weak passwords in their everyday accounts, including in the workplace? There are several reasons.

Convenience: Many people prefer to use easy-to-remember passwords. Trying to remember a fourteen-character-long password with letters, numbers, and symbols is difficult, and most people prioritize ease of use over security.

Multiple Accounts: As people sign up for more and more accounts, the need to remember these passwords increases. People often use the same simple password across numerous sites to simplify this.

Lack of Awareness: Some users may not fully understand the importance of having strong passwords or the risk involved with using these weak passwords. They may also underestimate the value of their data and believe that the chance of them being targeted by an attacker is low.